CVEs in the dependencies are in the execution path of your project

Your project uses some dependencies with CVEs. I found that the buggy methods of the CVEs are in the program execution path of your project. To prevent potential security risks it may cause, I suggest to update the library dependency. Here is the detailed information:

* **Vulnerable Dependency:** org.apache.hadoop : hadoop-common : 2.7.1

* **Call Chain to Buggy Methods:**

* **Some files in your project call the library method org.apache.hadoop.io.SequenceFile.Reader.next(org.apache.hadoop.io.Writable,org.apache.hadoop.io.Writable), which can reach the buggy method of [CVE-2017-15713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15713).**

* Files in your project:
hdfsreader/src/main/java/com/alibaba/datax/plugin/reader/hdfsreader/DFSUtil.java
* One of the possible call chain:

```
org.apache.hadoop.io.SequenceFile.Reader.next(org.apache.hadoop.io.Writable,org.apache.hadoop.io.Writable) [buggy method]
```

* **Some files in your project call the library method org.apache.hadoop.security.UserGroupInformation.loginUserFromKeytab(java.lang.String,java.lang.String), which can reach the buggy method of [CVE-2017-15713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15713).**

* Files in your project:
hdfsreader/src/main/java/com/alibaba/datax/plugin/reader/hdfsreader/DFSUtil.java, hdfswriter/src/main/java/com/alibaba/datax/plugin/writer/hdfswriter/HdfsHelper.java
* One of the possible call chain:

```
org.apache.hadoop.security.UserGroupInformation.loginUserFromKeytab(java.lang.String,java.lang.String)
org.apache.hadoop.security.UserGroupInformation.isSecurityEnabled()
org.apache.hadoop.security.UserGroupInformation.isAuthenticationMethodEnabled(org.apache.hadoop.security.UserGroupInformation$AuthenticationMethod)
org.apache.hadoop.security.UserGroupInformation.ensureInitialized()
org.apache.hadoop.security.UserGroupInformation.initialize(org.apache.hadoop.conf.Configuration,boolean)
org.apache.hadoop.security.SecurityUtil.getAuthenticationMethod(org.apache.hadoop.conf.Configuration)
org.apache.hadoop.conf.Configuration.get(java.lang.String,java.lang.String)
org.apache.hadoop.conf.Configuration.substituteVars(java.lang.String) [buggy method]
```

* **Some files in your project call the library method org.apache.hadoop.security.UserGroupInformation.setConfiguration(org.apache.hadoop.conf.Configuration), which can reach the buggy method of [CVE-2017-15713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15713).**

* Files in your project:
hdfsreader/src/main/java/com/alibaba/datax/plugin/reader/hdfsreader/DFSUtil.java, hdfswriter/src/main/java/com/alibaba/datax/plugin/writer/hdfswriter/HdfsHelper.java
* One of the possible call chain:

```
org.apache.hadoop.security.UserGroupInformation.setConfiguration(org.apache.hadoop.conf.Configuration)
org.apache.hadoop.security.UserGroupInformation.initialize(org.apache.hadoop.conf.Configuration,boolean)
org.apache.hadoop.security.SecurityUtil.getAuthenticationMethod(org.apache.hadoop.conf.Configuration)
org.apache.hadoop.conf.Configuration.get(java.lang.String,java.lang.String)
org.apache.hadoop.conf.Configuration.substituteVars(java.lang.String) [buggy method]
```

* **Update suggestion:** version 3.2.1
3.2.1 is a safe version without CVEs. From 2.7.1 to 3.2.1, 12 of the APIs (called by 38 times in your project) were modified.

Read hdfsreader/src/main/java/com/alibaba/datax/plugin/reader/hdfsreader/DFSUtil.java and hdfswriter/src/main/java/com/alibaba/datax/plugin/writer/hdfswriter/HdfsHelper.java, then locate the hadoop-common dependency declaration. Check the Hadoop 2.7.1-to-3.2.1 API changes and run the existing project tests; done means the dependency is updated, these call sites compile, and the reader and writer behavior remains covered.

Written by the indexing model from the issue text.